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Abstract 

We show that Nechiporuk's method for proving lower bounds for Boolean formulas can be 
extended to the quantum case. This leads to an 17 (n^/ log^ n) lower bound for quantum formulas 
computing an explicit function. The only known previous explicit lower bound for quantum formulas 
[!?[ states that the majority function does not have a linear-size quantum formula. We also show that 
quantum formulas can be simulated by Boolean circuits of almost the same size. 
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1 Introduction 

Computational devices based on quantum physics have attracted much attention lately, and quantum al- 



gorithms that perform much faster than their classical counterparts have been developed [ |12| , |21| , [22[ ]. To 
provide a systematic study of the computational power of quantum devices, models similar to those for 
classical computational devices have been proposed. Deutsch [^] formulated the notion of quantum Tur- 
ing machine. This approach was further developed by Bernstein and Vazirani [^], and the concept of an 
efficient universal quantum Turing machine was introduced. As in the case of classical Boolean computa- 
tion, there is also a quantum model of computation based on circuits (or networks). Yao [ p7| ] proved that 
the quantum circuit model, first introduced by Deutsch [p^], is equivalent to the quantum Turing machine 
model. 
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Since every Boolean circuit can be simulated by a quantum circuit, with at most a polynomial factor 
increase in its size, any nontrivial lower bound for quantum circuits could have far reaching consequences. 
In classical Boolean circuit theory, all nontrivial lower bounds are for proper subclasses of Boolean circuits 
such as monotone circuits, formulas, bounded-depth circuits, etc. In the quantum case also it seems that 
the only hope to prove nontrivial lower bounds is for proper subclasses of quantum circuits. So far the only 
such known lower bound has been derived by Yao [27] for quantum formulas .[] The quantum formula is a 
straightforward generalization of the classical Boolean formula: in both cases, the graph of the circuit is 
a tree. Yao has proved that the quantum formula size of the majority function MAJ„ is not lineaiQ; i.e., if 

L(MAJ„) denotes the minimum quantum formula size of MAJ„ then lim„ >oo -L(MAJ„)/n = oo. This 

bound is derived from a bound on the quantum communication complexity of Boolean functions. 

In this paper, we prove an almost quadratic lower bound for quantum formula size. The key step in 
the derivation of this lower bound is the extension of Nechiporuk's method to quantum formulas; for a 
detailed discussion of Nechiporuk's method in the Boolean setting see [ [IT| , ^ ]. Nechiporuk's method has 
been used in several different areas of Boolean complexity (e.g., see | [TT| ] for details). It has also been 
applied to models where the gates do not take on binary or discrete values, but the input/output map still 
corresponds to a Boolean function. For example, in [23] this method has been used to get a lower bound 
for arithmetic and threshold formulas. The challenging part of this method is a step that we shall refer 
to as "path squeezing" (see §H| for the exact meaning of it). Although in the case of Boolean gates, this 



part can be solved easily, in the case of analog circuits it is far from obvious (see [23]). For the quantum 
formulas "path squeezing" becomes even more complicated, because here we should take care of any 
quantum entanglement and interference phenomena. We show that it is still possible to squeeze a path with 
arbitrary number of constant inputs to a path with a fixed number of inputs. This leads to a lower bound 
of r2(n^/log^n) on the size of quantum formulas computing a class of explicit functions. For example, 
we get such a bound for the Element Distinctness function ED„. The input of ED„, for n = 2i log £, is of 
the form {zi, . . . , ze), where each Zj is a string of 21og£ bits. Then ED„(zi, . . . , ze) = I ii and only if 
all these strings are pair wise distinct. 

In the end of the paper we compare the powers of quantum formulas and Boolean circuits. Surprisingly, 
in some sense quantum formulas are not more powerful than Boolean circuits. Any quantum formula 
of size s and depth d can be approximated by a Boolean circuit of size 0(s log s log log s) and depth 
0((i log log s). Similar results are not known, and most probably are not true, for quantum circuits and 
other models which are depending on real number parameters (like arithmetic circuits [|23|]). The key idea 
for this simulation is that the computation of a quantum formula on an input (which is a pure state in the 



'There are exponential lower bounds on the time of quantum computation for the black-box model (see, e.g., ||3||), but they 
do not apply to the size of quantum circuits. 



The value of MAJ„(xi, ... , a;„) is 1 if at least \n/2] of inputs are 1. 
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Hilbert space) can be described as performing a sequence of unitary operations on 4 x 4 density matrices 
of mixed states. 

In this paper we use the notation | • | for two different purposes. When a is a complex number, \a\ 
denotes the absolute value of a; i.e., |a| = Va ■ a*. While if X is a set then \X\ denotes the cardinality 
of X. 

2 Preliminaries 

A quantum circuit is defined as a straightforward generalization of acyclic classical (Boolean) circuit (see 
[p^]). For constructing a quantum circuit, we begin with a basis of quantum gates as elementary gates. 
Each elementary gate g with d inputs represents a unitary operation Ug € U(2"'), where U(m) denotes the 
group of m X m unitary complex matrices. The gates are interconnected by quantum "wires". Each wire 
represents a quantum bit, qubit, which is a 2-state quantum system represented by a unit vector in C^. Let 
{|0) , |1)} be the standard orthonormal basis of C^. The |0) and |1) values of a qubit correspond to the 
classical Boolean and 1 values, but a qubit can also be in a superposition of the form a |0) +/? where 
a,/? € C and |ap + |/3p = 1. Note that the output of such gate, in general, is not a tensor product of 
its inputs, but an entangled state; e.g., a state like |00) + |11) which can not be written as a tensor 
product. 

If the circuit has m inputs, then for each d-input gate g, the unitary operation Ug E U(2'^) can be 
considered in a natural way as an operator in U(2™) by acting as the identity operator on the other (m — d) 
qubits. Hence, a quantum circuit with m inputs computes a unitary operator in 11(2"*), which is the product 
of successive unitary operators defined by successive gates. 

The size of a quantum circuit C, denoted by size(C), is the number of gates occurring in C. The depth 
of C, denoted by depth (C), is the length of the longest path in C from an input to an output gate. 

In this paper, we consider quantum circuits that compute Boolean functions. Consider a quantum 
circuit C with m inputs. Suppose that C computes the unitary operator Uc E U(2™). We say C computes 
the Boolean function / : {0, 1}" — > {0, 1} if the following holds. The inputs are labeled by the variables 
xi, X2, • • • , or the constants |0) or 1 1) (different inputs may be labeled by the same variable Xj). We 
consider one of the output wires, say the first one, as the output of the circuit. To compute the value of 
the circuit at (ai, . . . , an) G {0, 1}", let the value of each input wire with label Xj be \aj). These inputs, 
along with the constant inputs to the circuit, define a unit vector | a) in C^™ . In fact this vector is a standard 
basis vector of the following form (up to some repetitions and a permutation) 

\a) = \ai) • • • |a„) |0) • • • |1) . 

The action of the circuit C on the input |a) is the same as C/c(|a)). Note that since Uc is unitary, 
ll^c(l«))ll = 1- We decompose the vector Uc{\(y)) G C^" with respect to the output qubit. Let the result 
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Figure 1: Quantum circuits and their computation graphs; the top circuit is not a formula while the bottom 
one is a formula. 



be 



f/c(|«)) = |0)®|^0,a) + |l) 



1^ 



l,a) 



Then we define the probability that C outputs 1 (on the input a) as po 



\A 



i.e., the square of the 



length of G C^" . Finally, we say that the quantum circuit C computes the Boolean function / if 

for every a G {0, 1}", if f{a) = 1 then p^ > 2/3 and if /(a) = then p^ < 1/3. 

Following Yao [p7|], we define quantum formulas as a subclass of quantum circuits. A quantum circuit 
C is a formula if for every input there is a unique path that connects it to the output qubit. To make this 
definition more clear we define the computation graph of C, denoted by Gc- The nodes of Gc correspond 
to a subset of the gates of G. We start with the output gate of C, i.e., the gate which provides the output 
qubit, and let it be a node of Gc- Once a node v belongs to Gc then all gates in C that provide inputs to 
V are considered as adjacent nodes of v in Gc- Then C is a formula if the graph Gc is a tree. Figure [I] 
provides examples of quantum circuits of both kinds, i.e., circuits that are also quantum formulas, and 
circuits that are not formulas. 

All circuits that we consider are over some fixed quantum basis. The lower bound does not depend on 
the basis; the only condition is that the number of inputs (and so the number of outputs) of each gate be 
bounded by some fixed constant number (this condition is usually considered as part of the definition of a 
quantum basis). For example, this basis can be the set of all 2-input 2-output quantum gates, and as as it 
is shown in [^, this basis is universal for computation with quantum circuits. 



4 



It is well-known that any Boolean circuit can be efficiently simulated by a quantum circuit over a 
universal basis. Indeed, for this purpose, the 3-bit Toffoli gate is enough (see, e.g., [§, [l7|]). Similarly, 
any Boolean formula can be efficiently simulated by a quantum formula using only Toffoli gate or a basis 



universal for classical computation. In the special case, from [ ]24| ] it follows that there is a polynomial-size 
log-depth quantum formula computing the majority function MAJ„. This fact implies that for quantum 
formulas over reasonable bases (i.e., universal for classical computation) the threshold probability of cor- 
rect answer (| in the above definition) can be efficiently boosted to a number arbitrarily close to one. 

For our proof we also need a Shannon-type result for quantum circuits. Knill [|^] has proved several 
theorems about the quantum circuit complexity of almost all Boolean functions. We will use the following 
theorem. 

Theorem 2.1 ([p3|]) The number of different n— variable Boolean functions that can be computed by size 
N quantum circuits (n < N) with d-input d-output elementary gates is at most 2'^^ ^ , where c depends 
only on d. 

For the sake of completeness, in Appendix we have provided a proof for a slightly weaker bound. 



Our approach is different from that in [ [151 ] and it seems it is shorter and simpler than the proof in [p3|]. 
Although the bound that we get is a little weaker than the bound provided by the above theorem (it is of 
the form 2'^("^)), our bound results in the same bound of Theorem if log(A^) = Q{n) which is true 
for almost all Boolean functions. Thus our result provides the same bound for the complexity of almost all 
functions and it is sufficient for the bound we get in this paper. 

We also need to consider general orthonormal bases in the space C^" other than the standard basis. In 
the context of quantum physics, we identify the Hilbert space C^" as the tensor product space (2)j=i 
and the standard basis consists of the vectors 

|ci) • • • \Cn) = |ci • • • Cn) , Cj G {0, 1}. 



Fact 2.2 Let \ Aj) G and \Bi) G be unit vectors (for j and £ in some index sets). If\Aj) are pair 
wise orthogonal and \ Bi) are pair wise orthogonal then the family 

[\Aj)0\Be)eC'"^"':j,e} 

is an orthonormal set. 

The following lemma, although seemingly obvious, is crucial for the "path squeezing" technique in 
the proof of the lower bound. 
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Figure 2: Decomposition of a quantum subcircuit acting on disjoint sets of qubits (Lemma |2 .31 (a)). 
<ri \r2 \rt 




Figure 3: Postponing the gates (Lemma 2.3 (b)). 



Lemma 2.3 (a) Suppose that C is a subcircuit of a quantum circuit. Let the inputs of C be divided into 
two disjoint sets of qubits Qi and Q2. Suppose that each gate of C either acts only on qubits from Qi or 
only on qubits from Q^- Then there are subcircuits C\ and C2 such that Cj acts only on qubits from Qj 
and the operation of C is the composition of operations of Ci and C2 no matter in which order they act; 
i.e., C = Ci o C2 = C2 o Ci. So the subcircuit C can be substituted by Ci and C2 (see Figure 

(b) Let C be a subcircuit of a quantum circuit with distinct input qubits q and ri, . . . , r^. Suppose that 
only t gates gi, ■ ■ ■ ,gt in C act on q. Moreover, suppose that each gj acts on q and rj. Then, w.l.o.g., we 
can assume that each qubit rj after entering the gate gj will not interact with any other qubit until the gate 
gt is performed ( see Figure 

Proof. Part (a) is based on the following simple observation. If M G U(2'") and N G U{2^) then 

M (g) iV = (M » /„) o (/„ N) 

= {Im^N)o{M^In), 

where It is the identity map in U(2*). Note that the inputs of the subcircuit C may be in an entangled 
state; but to see that the equality C = Ci o C2 = C2 o Ci holds, it is enough to check this equality for the 
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Figure 4: Changing the order of gates (Lemma 2.3 (b)). 



standard basis and extend it to the whole space by linearity. 

Part (b) follows simply from part (a); as in Figure ^, part (a) can be applied on subcircuit consisting of 
gates /i2 and h^- Note that in this case also input qubits rj of gj's may be in an entangled state. Again a 
linearity argument shows that we have to consider only the case that rj 's are in a product state. I 



The above lemma is special case of a more general fact that operations on one part of a bi-partite 



quantum system do not affect the result of operations on the other part (for more details see, e.g., [18]) 



3 A new equivalent definition for quantum formulas 



Kitaev |14] has brought to our attention that quantum formulas are equivalent to a model that is very 



similar to the classical formulas. In this model the inputs and the intermediate results are density matrices. 
Each gate is a completely positive trace-preserving super-operator, which maps density matrices of a d- 
qubit systems to one-qubit density matrices. The underlying graph, like a classical formula, is a directed 
tree; i.e., from each input there is a unique path to the output gate. Thus the output of such circuit is a 
density matrix of a single qubit which provides the probability of the output "0" or "1". To make the paper 
self-contained, we first present the definitions of the notions mentioned in this new definition. 

By a pure state \a) we mean a unit vector in some Hilbert space C^". A mixed state {V'} in C^" is 
a probability distribution on pure states in this Hilbert space. We denote such a mixed state as {ijj} = 
{Pkj I V'A;)}' where Pfc > and Ylik Pk = 1- Then {tp} picks the pure state | V'fc) with probability p^. 

The density matrix of a pure state \a) is the matrix p^^) of the linear mapping |a )( a|; i.e, the mapping 
\x) — > (a \x) \a). So, if |0) , |1) , . . . , 12" — 1) represent the standard computational basis of C^" and 
|a) = J2k then the entry of p^^) is AjA^. The importance of density matrix is that it suffices 

to characterize the quantum state of the system. Specially, this matrix is enough to find the probabilities 
of measurements. In general, the result of each measurement can be represented by action of a projection 
operator T on the given state |q), where J" is a projection onto some subspace £. Then the probability that 
the result of the measurement is in the subspace £ is equal to Tr(J' P\a)). 
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The density matrix of a mixed state {ip} = {pk, {tpk}} is defined as 

k k 

Like the case of pure states, the probability that the result of the measurement is in the subspace £ is equal 

toTr(a'P{v>}). 

If the (pure or mixed) state \ip) can be written as the tensor product (gi \x) then the density matrix 
p\^) is equal to the tensor (Hadamard) product p\^) ® p\^y 

The next important notion is partial trace. Consider the Hilbert spaces "Ki = C^" and 'Ki = C^™ and 
J{ = 'Ki ® ^2 ; so J{ is isomorphic with C^"^" . Let 

= {|ni) : i = l,... ,2"} and S2 = { b,) : j = 1, . . . , 2"^ } 

be orthonormal bases for CKi and ^{2, respectively. Then 

Si = { \ui) ® \vj) : i = 1, . . . , 2^^, j = 1, . . . , 2"* } 

is a basis for "K. Let p be the density matrix of a mixed state in the space 3i. It is possible to restrict the 
state to the subspace Jii. The result is a partial trace p\-}i-^ = Tr-ji^ P which is density matrix of some 
mixed state in the subspace CKi. We also say that the subspace ^2 is traced out. The partial trace p\'ji-^ 
enables us to calculate probabilities of the results of the measurements bearing only on the subspace !Ki. 
We assume that the rows and columns of the matrices p and p\-ji^ are labeled by the vectors in the basis 
Si (g) S2 and Si, respectively. For example, p{\ui-^) \vj^) , \ui^) \vj^)) is the entry of p at row labeled by 
Kn) ® bii) ^i^d the column labeled by \ui^) ® \vj^). With this notation, the partial trace is defined 
as follows 

2m 

Pki {\uh) , lui^)) = l^i) ' l^^a) ■ 

i=i 

Again let £ be a subspace of "Ki . We can identify it with subspace £ (g 'K2 of "K. Let ? : "Ki — > £ 
be the projection operator associated with £. The operator ? can be extended to the whole space 3-C in a 
natural way as the operator 7 ® Idji^, where Id^^ is the identity operator on 'K2. Then the probability 
that the result of the measurement is in the subspace £ is equal to Tr(J' pIjCi ). (For more details on density 
matrices of mixed states and the partial trace see, e.g., [||].) 

Let C be a quantum circuit. For inputs of C it is possible to consider mixed states along with pure 
states. Toward this end, each input is substituted by its density matrix, and each gate 51 of C by a super- 
operator g that maps density matrices to density matrices. In fact, if the unitary operator of the gate g is 
U, then the action of g on the density matrix p is as follows: 

g{p)=gop=UpUl (1) 
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Lemma 3.1 ([|l|]) If the gates gi and 52 operate on disjoint sets of qubits, then for any density matrix p we 
have gio 92° P = 92° 91° P- 



First we show that every quantum formula is equivalent to a circuit based on this new definition. 
Let 9^ be a quantum formula on a basis of d-bit gates. Construct a circuit S from 3" by the following 
transformations. In each gate 9, performing the unitary operation f/ E U (2*^) , keep the only output which 
is connected to the output and substitute the operator U by the super-operator [9] = Tx'ji o 'g, where "K is 
the {d— l)-dimensional subspace spanned by the qubits removed from the output of this gate. The fact that 



the circuit C computes the same function as the formula 9" follows from Lemma pjj . Thus the underlying 
graph of the circuit C is the same as the computation tree of the formula 3", where the node corresponded 
with the gate g computes the super-operator [9] . 

Let now C be a circuit based on this new definition. We construct a quantum formula 3" from C by 
simply substituting each gate of C, computing the super-operator T, by a (d + 2)-input {d + 2)-output 
unitary gate U, only one output of this gate is connected to the next gate and the other outputs never interact 
with any other qubit. So 3" satisfies our original definition of quantum formula. The only thing remains is 
to show how we can choose the unitary operators U such that the formula 3" computes the same Boolean 
function as C. The following theorem guarantees the existence of the correct operator U, for each gate of 
C. Here L(;K) is the space of linear operators on the Hilbert space 3{ and for unitary operator U on "K, the 
operator 0,7 G L(J{) is defined as Oc/(M) = UMU'^. 

Theorem 3.2 ([0, [I^, 16, 2^) Suppose that T : L (^1) — > L {'K2) is a trace-preserving and completely 
positive super-operator. Then there are Hilbert spaces 9i and S2, where dim (Si) = (dim(Jf2))^ (^nd 
dim (S2) = dim • dim {^2), cind there is a unitary operator U : !Ki (X" Si — > '^2 "SD S2 that 
T = Trg, o Ou. 

We would like to mention that from now on it might be more useful to accept the new modified 
definition as the standard one for quantum formulas in the literature. 

4 The lower bound 

Let f{xi, . . . ,Xn) be a Boolean function. Let X = {xi, . . . ,x„} be the set of the input variables. 
Consider a partition {Si, . . . , Sk} of X; i.e., 

k 

X=\JSj and 5,, n 5,, = 0, for n + h- 

Let TLj = \Sj\, for j = 1, . . . ,k. Let 3j be the set of all subfunctions of / on Sj obtained by fixing the 
variables outside Sj in all possible ways. We denote the cardinality of 3j by aj. 
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As an example, we compute the above parameters for the Element Distinctness function ED^ (see 
[^). Let n = 2l\o^l (so i = Q.{n/ logn)) and divide the n inputs of the function into I strings each of 
2 log i bits. Then the value of ED„ is 1 if and only if these i strings are pair wise distinct. We consider 
the partition {Si, . . . , Se) such that each Sj contains all variables of the same string. Thus nj = \Sj\ = 
21og£. Each string in Sj represents an integer from the set {0, 1, . . . — 1}. The function ED„ is 
symmetric with respect to Sj's; so = To estimate note that if the strings {z2, ... , Zi) in 

S2, ■ ■ ■ ,Si represent distinct integers then the corresponding subfunction is different from any subfunction 
corresponding to any other string. So crj = > > 

Theorem 4.1 Every quantum formula computing f has size 

log (cTj) 



Proof. We give a proof for any basis consisting of 2-input 2-output quantum gates. The proof for 
bases with more than two inputs is a simple generalization of this proof. 

Let F be a formula computing /. Let be the set of input wires of F labeled by a variable from Sj, 
and let Sj = | E j | . Then 

s\zeiF) = n( Sj)- (2) 

We want to consider the formulas obtained from F by letting the input variables not in Sj to some constant 
value |0) or In this regard, let Pj be the set of all paths from an input wire in Ej to the output of F. 
Finally, let Gj be the set of gates of F where two paths from Pj intersect. Then \Gj\ < Sj. 

Let r be an assignment of |0) or |1) to the input variable wires not in Sj. We denote the resulting 
formula by Fr. Thus Fr computes a Boolean function : {0, 1}"J — > {0, 1} which is a subfunction of 
/ and a member of 3"j . Consider a path 

TT = {gi,g2,... ,gm), m > 2, (3) 

in Ft, where gi is an input wire or a gate in Gj, gm is a gate in Gj or the output wire of F, and g£ Gj 
for 1 < £ < m. 

To show how we can squeeze paths like (^ (this is the essence of the Nechiporuk's method), we 
introduce the following notations. We consider a natural ordering 71 , 72 , . . . , 7t on the gates of the formula 
Ft, and regard F-j- as a computation in t steps where at step i the corresponding gate 7^ is performed. We 
say two qubits qi and q2 are strong companions of each other at step i if there is a gate 7j such that j < i 
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Figure 6: Squeezing a path. 



and qi and q2 are inputs of 7^. We say qubits qi and (72 are companions of each other at step £ if there 
exists a sequence ri, r2, . . . , rp of qubits such that ri = qi,rp = q2, and and rj+i (for I < j < p — I) 
are strong companions of each other at step i (see Figure If (71 and q2 are companions at step i then 
they are also companions at any step after £. For a gate (7 = 7^,, we define the set of companions of g as 
the union of all companions of input qubits of g at step k. 

Suppose that in the path (||) gi = jj^, gm = 7ji, the inputs of gi are qo and qi, the output of from 
the path (^ is the qubit qQ, and the input of 7^^ not from the path (^ is the qubit q2 (see Figure Note that 
qo is the companion of q2 at step ji. Let Qtt be the union of all sets of companions of g2, ■ ■ ■ , 5m- 1 minus 
qo and qi and their companions at step ji. Let Cq be the circuit defined by the gates gi, ■ ■ ■ , gm-i from the 
path (^). Suppose that \Qt^\ = v and consider Cq as an operation acting on 3< = (8) (8) C^". To study 
the action of the subcircuit Cq, it is enough to consider the action of Cq on the computational basis vectors 
of the space "K. Therefore, while the inputs of Cq as a subcircuit of Fr are in general entangled states, we 
only have to study the action of Cq on the computational basis vectors which are product states. We label 
the inputs \ ao) (8) |ai) |q) G 3i of Cq in such a way that when Co acts as a subformula of Fj- then |ao)> 
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and |a) are replaced by q^, qi, and the companion qubits in Qtt, respectively. Note that, because F-r 
is a formula, all qubits in are constant inputs of and do not intersect any other path like @. So, 
when Co acts as a subformula of Fr, the input \a) of the subcircuit Co is the same for all possible inputs 
for |qo) and |ai). Therefore, let Co be a circuit such that on input |qo) <8> |ai) ® |0 • • • 0) G Og)C^® C^", 
it first computes \ao) 0\ai) 0\a) then performs the action of Co on |ao) <8> <8> \a). Then if we replace 
Co by Co and assign the value |0) to the qubits in Qtt, then the result is a circuit equivalent to F^-. Suppose 
that the act of Co be defined as follows 

\ao) <S) \ai) |0 • • • 0) ^ Yl l^o) ® l^i) ® l^Z'ci') ' W 

co,ci6{0,l} 

where ao, ai G {0, 1}, and |74co°cT) ^ may be not a unit vector. Let Aj^ C C^" be the vector space 
spanned by |Aco°c"^), for ao, ai, cq, ci G {0, 1} and d = dim(yi7r). Then 1 < d < 16. Let 1^^^) , . . . , 
be an orthonormal basis for A^^. Then we can rewrite as follows 

|ao) |ai) |0 • • • 0) ^ Yl E l^o) ® l^i) ® I^J> • 

co,cie{0,l} l<j<d 

Let M,r be the set of those unitary operations that are performed after one of the gates gi, ■ ■ ■ , Qm-i 
on some qubits in Qt^ before the step ji. Since qubits in Qtt do not interact with any other path of the 
form (Q), by Lemma 13 (b), we can postpone all operations in M^r after we computed the output of gm- 
Let vTi, . . . , TTfc be a natural ordering on the paths like ^ on all paths in Pj (i.e., the last gate of vTj+i is 
not performed before the last gate of vTj). Consider the sets of postponed operations , . . . , Mtt^.. Once 
again Lemma 23 implies that we can postpone operations in after the last gate of -k^, then we can 
postpone operations in M,rj and M,r2 after the last gate of tts, and so on. Repeating this argument shows 
that we can postpone all operations in Mtt^ , • • • , M^^. after we compute the output qubit. In this way, the 
state of the output qubit, before the postponed operations M^rj , . . . , Mtt^. are applied, is of the form 

|0)®|M) + |l)®|iV), (6) 

where the first qubit is the output qubit and | M) and | N) are superpositions of tensor products of orthonor- 
mal vectors |j4^^ ) used in @. By Fact [2.2[ , these tensor products of the vectors |j4^^ ) are unit vectors and 
pair wise orthogonal. The unitary operations in the sets Mtt^ (for paths vTj of the form (||)), which are 
postponed to the end, do not change the lengths of | M) and | N) . Thus, as far as the computation of the 
Boolean function is concerned, we can ignore all the postponed unitary operations. For this reason we 
construct the circuit F^ from the formula Fr by eliminating all postponed operations in Mtt^ , substituting 
for each path ttj of the form (||) the companion qubits in Q^^^ by four new qubits, and the unitary operation 
(||) by the operation defined as 

|ao) 10000) ^ ^ A^'i l^o) ® ® li) • (7) 

co,ciG{0,l}0<j<15 
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The output of the circuit Ft, instead of is of the form 

|0)®|M'> + |l)®|iV'>, (8) 
where |||M)|| = |||M')|| and |||7V)|| = |||iV')ll- So the circuit ^ computes Moreover, 

size(FT-) = 0{sj), 

and for another assignment r', the corresponding circuit Ft' differs from Fr only at unitary operations 
defined by (0). 

The above discussion implies that aj, the number of subfunctions on Sj, is at most the number of 
different Boolean functions computed by size 0{sj) quantum circuits. Therefore, by Theorem [2.1[ , we get 

So Sj = r2(log(cTj) /log log(cTj)). Now the theorem follows from @. I 

We would like to mention that the fact that a path Uke (0) can be squeezed to a path of constant length 



is a special case of the general property of super-operators stated in Theorem 3.2 



To apply the general bound of the above theorem, we could consider any of the several explicit func- 



tions used in the case of Boolean formulas (see |2q]). As we mentioned in the beginning of this section, 
we consider the Element Distinctness function ED„. For this function aj > i^^^, where £ = Q{n/ log n). 
Therefore, we get the lower bound Q{£^) = Q.{'n? / log^ n) for the formula size. 

Theorem 4.2 Any quantum formula computing ED„ has size Q{n'^ / log^ n). 



5 Quantum formulas vs. Boolean circuits 

In this section we show that quantum formulas are not more powerful than Boolean circuits. So as a model 
of computation, their strength lies between Boolean formulas and Boolean circuits. 

Following the idea developed in Section ^, we consider a quantum formula as a quantum circuit oper- 
ating on mixed states. For the details of quantum circuits with mixed states see ^ [T3|]. Before we start the 
proof of the main result of this section, we need to see how we can bound errors in quantum circuits with 
mixed states. Toward this end we need a suitable norm on super-operators. Each super-operator T which 
maps density matrices to density matrices is a linear mapping of the form L(lKi) — > L(J{2), where "Ki 
and 'K2 are finite-dimensional Hilbert spaces and L(3-Cj ) is the set of linear operators on "Kj. Note that 
L(^Kj ) itself is a linear space. Let be an m-dimensional Hilbert space. There are several norms on the 
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space L(I>{), of which we need the following ones. Let A e L(;K). We identify A with its m x m matrix 
{ttij). The first norm is 



M{A) = mmax|aij|. 

The usual norm is defined as 

\\A\\ = sup ^^f. ^^]} = max | a/A : A G Spec(^"l'^) \ , 
|x>^o Ilk) II I- J 

where Spec(M) is the spectrum of the matrix M; i.e., the set of the eigenvalues of M. The other norm is 
the trace norm: 

AeSpec(AtA) 

We need the next norm ||-||^ to define another norm: let T be a linear operator that maps matrices to 
matrices; i.e., T G 'L(L{%)), then 

A^Q ll^llTr 

The last norm we consider is the diamond norm, defined in [[I^] and also in [|l|]. To define this norm, we 
consider a Hilbert space S such that dim(9) > dim(J{) and we let 

\\t\i = \\t®Iq\1, 

where /g is the identity operator on S. The foUowings are the basic properties of these norms. 

(i) iM{A) < \\A\\ < M{A). 

(ii) Pllxr ^ Pll- 

(iii) ||r(p)||rpj. < ||r||^ IIpIIti' "^^e density matrix p. 

(iv) iiTiiii, < ||r||j|ii||,. 

(V) \\T®R\1 = \\T\\JR\1. 

(vi) If T = for some quantum gate g,orT = Trgr, then ||T||^ = 1. 

The properties (iii)-(vi) are proved in [l3| ]. 

For any operator V G L(;K) we define the operator Oy G L(L(Jf)) as 

Ov{M)=VMV\ MgL(:K). (9) 

In ||l[ |13|] it is proved that ||0y - OvkIIo < 2 ||y - ^11 if II ^11 ^ 1 and ||T^|| < 1. We need the following 
general form of this inequality. 
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Lemma 5.1 Let dim(J{) = m. For any V,W e L(3i) we have 

- OvkIIo ^ 2m \\V - W\\ min(||1/|| , \\W\\) +m\\V-W 



Proof. We have (for A G L ( ® IK)) 
||0v - OvfIIo 

(V /jc) A (Ft 55 /^) -{W(S) I^) A {W^ ® I:k) 



sup \\{(Dv ® /5€)^ - {Ow ® /:K)^|lTr / WMtt 



sup 

A^O 

sup\\{V(g)I:K)A{V^ ^Iji) 

A^O 



\A\ 



Tr 



Tr 



{{V + {w- V)) ® /jc) A ((yt + (vFt - yt)) ^ p| 



Tr 



< sup 
A^O 

sup 

A^O 

sup 

A^O 



{V®Iji)A{(W^ -V^)®I^) /\\A\\^ + 



Tr 



{{W -V)®Ik)A{V^ /\\a\\t^ + 



Tr 



(10) 



{{W -V)® I^) A ((VFt _ yt) ^ j^) / pii^^ 



Since \\MN\\ < \\M\\ ■ \\N\\, \\M\\ < \\M\\r^^ < m||M||, \\M ® N\ 
\\I'k\\ = 1> it follows that 



IMII • ||iV||, llAftl 



IMIL and 



Tr 



< m 



< m \W 



• ll^ll • 



< m\\V\\-\\A\\r^-\\W -V\ 



By applying a similar reduction to the other terms of (|l^), we drive the following inequality 

W^v - Ow'llo < 2m \\V - W\\ ■ \\V\\ +m\\V - W\\^ . 
We can also drive a similar inequality with ||F|| substituted by \\W\\. This completes the proof. I 



We say two n x m matrices A = {aij) and B = {hij) are 5-close to each other if \aij — bij\ < 6, for 
every I < i < n and 1 < j < m. If the m x m matrices A and B aie 5-close to each other then 



\A-B\\ <M{A-B) <m5. 



(11) 



The following theorem formalizes the general form of the error bound for quantum circuits when 
approximating the unitary operator of each gate. This theorem is actually a generalization of a weaker 
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theorem which has appeared in several papers (see, e.g., ^, 13]). We need this generalization because 
once we substitute any unitary gate S of the original quantum circuit by some approximated gate T, in 
general we do not know whether ||r|| < 1 or not (this is the assumption of the weaker version of this 
theorem). 

Theorem 5.2 Let Sj,Tj e L (l (c^'')), I < j < i, be defined as Sj = Ouj and Tj = Ovj, where 
Uj G U(2'^) is unitary and Vj is 5-close to Uj. Then 

\\Se--- S3S2S1 - T, • • • nr^Ti \l < e''^'^'^)^ - 1, 

where r]{d, 6) = 2^'^+^6 (l + 2'^5). 

Proof. First note that 

ll^.-^;-llo = l|o^.-Ov,|L 



< 2''+^ \\Uj - VjW {1 + \\Uj - VjW) by Lemma y 

< 2^'^+^6 (1 + 2'^6) by (P) 



and, by (vi), 

||T,||, < + \\Sj - < l + 7j{d,5). (12) 

Also we have the following simple inequality 

llMaMi-TVsiVillo = ||M2(Mi-Ar,)-(M2-iV2)iVi||^ 

< ||M2||J|Mi-iVi||^ + ||iVi||J|M2-iV2||, (13) 



Now, by repeated applications of (12) and (13), we have 

\\Sr--S3S2Si-Ti---nT2Ti\l < \\S,. ■■ 838211 J\Si - T^^ + 

\\Ti\\J8e---8,82-Te...TsT2\l 

< 7](d, 6) + {l + r]{d, 6)) \\8e--- 8382 - T, • • • T3T2I 

< T]{d,S)+7]{d,6){l+r,{d,5)) + 

{l + r]id,5)f\\8r--S3-Ti---T3\l 



< 



i-i 

ri{d,6)Y,{^ + vid,6)y 

j=0 

= {i + ^{d,6)Y-l 
< e''('^'^)'^ - 1. I 
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The following theorem is the immediate consequence of the above theorem. Note that for a gate g the 
super-operator g is defined by ([I]). 

Theorem 5.3 Let C be a quantum circuit composed of the gates gi, . . . ,gs- Suppose that each gj is a 
d-bit gate computing the unitary operator Uj S U(2'^). For each 1 < j < s, let V^- € L ^C^''^ be a 

6— close matrix to Uj. Let Tj G L ^C^"*^ ^ be defined as Tj = Oy^.. For any input density matrix po, let 

= {gs ® I-K,) o ■ ■ ■ o (92 ® I-K2) ° {ai ® Ijii)PO 

be the output of C, where "Kj is the Hilbert space generated by the qubits not involved with the gate gj. 
Also, let 

C = (T, ® /:kJ • • • {T2 I:k2){Ti /jcj Po 
be the approximated output of C. Then 

||V-CllTr< (e"^'''^^-!) IIpoIItt, 
where r]{d, 5) = 2'^^+^6 (l + 2'^5). 



Theorem 5.4 Let "B be a quantum basis. Then each quantum formula of size i and depth d over the basis 
'B can be simulated with error at most e by a Boolean circuit of size O {i fx log fi log log /i) and depth 
O {d log n), where fi = [log £ — log e] . 

Proof. The basic idea of the simulation is to look at the behavior of a quantum formula as a quantum 
circuit acting on density matrices of mixed states. We assume, w.l.o.g., that each gate in the basis B is a 
2-bit gate. 

Consider a quantum formula ff'over the basis "B; suppose that J" has t inputs (constant or variable) and 
computes the Boolean function / : {0, 1}" — > {0, 1}. We show that there is a Boolean circuit C that for 
any input a = (ai, . . . , a„) G {0, 1}" simulates the action of 3" on a. Let la) = |0) \ Ao) + |1) 
be the output of 3" on the input a. Suppose that the first qubit is the output bit. If we trace out the non- 
output bits of I a), the result is a 2 x 2 density matrix /Ofinai = p\\a)- From /Ofinai it is easy to calculate 
the probability of acceptance of J". The formula structure of 9" allows us to calculate the density matrix 
Pfinai without going to the 2* dimensional space. The Boolean circuit C finds the density matrix pfinai by 
simulating the gates of step by step. 

Since the trace norm of a density matrix is equal to its trace, it follows that UpoIItt ~ 1' where po is 
the density matrix of the input. 
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Now the gates of 3" are no longer acting on pure states, but they are acting on mixed states. If the input 
of a gate gj, (performing the unitary operation Uj) is the 4x4 density matrix p then the output is the 
density matrix p' = Uj p Uj^ . Of the two output bits qi and q2 of this gate only one, say qi, is connected 
to the output bit of 9". So we trace out the system representing q2 and consider the new density matrix 
p\q-^ = Tr^jp' for qi. By repeating this process for each gate of 3" we finally get the desired density matrix 



Pfinai- The correctness of this process follows from Lemma ^ 



The Boolean circuit C can simulate the calculations of these density matrices pg-^ . The only problem 
for this simulation is the proper approximation of the entries of unitary matrices Uj . If we substitute each 
entry of Uj by its first p = — [log2 5] bits, then we get a matrix that is (5-close to Uj. Let 9" be the 
resulting formula and yOgnai be the output of 9". Then, by Theorem ||pfinai — PfinaiUxr — e'^^'^'^^^ — 1. 
So if (5 = 0(f), i-S-, p = O {logi — lege), then the simulation of 3" by 3" has at most e error. The 
theorem now follows from this fact that addition and multiplication of m bits numbers can be carried out 
by Boolean circuits of size 0(m log m log log m) and depth 0(log m) (see [|l9l E6|]). I 



Why does this proof not provide a Boolean formula instead of Boolean circuit? The reason is that to 
calculate p' = Uj p Uj\ we need 4 copies of each entry of p. Thus the fan-out of the gates in the Boolean 
circuit obtained from the formula 3" is 4. This means that the Boolean formula equivalent to this Boolean 
circuit, in general, has size exponential in this size is at least Q. if the graph of 3" is a full binary 
tree. 



6 Concluding Remarks 

We have extended a classical technique for proving lower bound for Boolean formula size to quantum for- 
mulas. The difficult part was to effectively deal with the phenomenon of entanglement of qubits. While we 
have been successful in extending a classical technique to the quantum case, the challenges encountered 
indicate that in general the problem of extending methods of Boolean case to the quantum case may not 
have simple solutions. For example, even the seemingly simple issue of the exact relationship between 
quantum formulas and quantum circuits has not been resolved. In the Boolean case, simulation of circuits 
by formulas is a simple fact, but in the quantum case it is not clear whether every quantum circuit can be 
simulated by a quantum formula. In particular, it is not clear that in the process of going from quantum 
circuits to formulas, how we can modify the underlying entanglement of qubits while keeping the proba- 
bility of reaching to the final answer the same. We were also able to show that it is possible to simulate 
quantum formulas with Boolean circuits of almost the same size. It does not seem that Boolean formu- 
las could efficiently simulate their quantum counterparts. So evidently quantum formulas, as a model of 
computation, are more powerful than Boolean formulas and less powerful than Boolean circuits. A better 
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understanding of the relations between these models remains a challenging problem. 



7 Appendix: Counting the number of Boolean functions computed by quan- 
tum circuits of a given size 

In this appendix we prove the following upper bound. 

Theorem 7.1 The number of different n— variable Boolean functions that can be computed by size N 

quantum circuits (n < N) with d— input d— output elementary gates (for some constant d) is at most 

20{nN)+0{N log N) 

Our proof is based on Warren's bound on the number of different sign-assignments to real polynomials 
[p^]. We begin with some necessary notations. 

Let Pi(xi, . . . , xt), . . . , Pm{xi, ... , xj) be real polynomials. A sign-assignment to these polynomi- 
als is a system of inequalities 

Pi(xi,... AiO, Pmixi,... ,xt)A^O, (14) 



where each Aj is either "<" or ">". The sign-assignment (|14|) is called consistent if this system has a 
solution in M*. 



Theorem 7.2 (Warren [25]) Let Pi{xi, . . . ,xt),... ,Pmixi,... ,xt) be real polynomials, each of degree 



at most d. Then there are at most {Aedm/tY consistent sign-assignments of the form (|I4]). 

We consider the class of quantum circuits of size N with d-bit gates computing n-variable Boolean 
functions. Without loss of generality, we can assume that n' , the number of input wires of such circuits, 
is at most d ■ N. We define an equivalence relation ~ on such circuits: we write Ci ~ C2 if and only if 
Ci and C2 differ only in the label of their gates; in another word, Ci and C2 have the same underlying 
graph but the corresponding gates in these circuits may compute different unitary operations. The number 
of different equivalence classes is at most 

/\ N 

Now we find an upper bound for the number of different Boolean functions that can be computed by 
circuits in the same equivalence class. Fix an equivalence class £. We use the variables ai + ibi,a2 + 
ib2, ■ ■ ■ , + ibfj_, where ^ = d'^N, to denote the entries of the matrices of the gates of a circuit C in £. By 
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substituting appropriate values to the variables ai, . . . , a^, bi, . . . ,b^, we get all circuits in £. On input 
a = (qi, . . . , an) € {0, 1}", the probability that C outputs 1 can be represented by a real polynomial 

Pa{ai,... ,a^,6i,... ,6^). 

The degree of Pa is at most 2N. There are 2" polynomials Pa and the number of different Boolean 
functions can be computed by C by changing the unitary operators of its gates is at most the number of 
different consistent sign-assignments to the following system: 

Pa{ai, ■ ■ ■ , fl/i, ^1, • • • ) ^m) ~ i' 

Pa{ai, ■ ■ ■ ,af^,bi,. . . , — i, 
for a G {0, 1}". By Theorem ^ this number is bounded from the above by 

/ 4e(2jV)2"+^ \^^ ^ ryO(nN)+0(NloKN) I 
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